loops. Soon after our first paper on this topic (and before
our subsequent work on Lipschitz continuity of programs), Reed and Pierce18 gave a type system that can verify the Lipschitz continuity of functional programs. This
system can seamlessly handle functional data structures
such as lists and maps; however, unlike our method, it
cannot reason about discontinuous control flow, and
would consider any program with a conditional branch
to have a Lipschitz constant of ∞.

More recently, Jha and Raskhodnikova have taken a
property testing approach to estimating the Lipschitz constant
of a program. Given a program, this method determines,
with a level of probabilistic certainty, whether it is either
1-Lipschitz or -far (defined in a suitable way) from being
1-Lipschitz. While the class of programs allowed by the
method is significantly more restricted than what is investigated here or by Reed and Pierce 13, the appeal of the method
lies in its crisp completeness guarantees, and also in that it
only requires blackbox access to the program.

Robustness is a standard correctness property in control
theory, 16, 17 and there is an entire subfield of control studying the design and analysis of robust controllers. However,
the systems studied by this literature are abstractly defined
using differential equations and hybrid automata rather
than programs. The systematic modeling and analysis of
robustness of programs was first proposed by us in the context of general software, and by Majumdar and Saha14 in the
context of control software.

In addition, there are many efforts in the abstract interpretation literature that, while not verifying continuity or
robustness explicitly, reason about the uncertainty in a program’s behavior due to floating-point rounding and sensor
errors. 6, 7, 10 Other related literature includes work on automatic differentiation (AD), 1 where the goal is to transform
a program P into a program that returns the derivative of P
where it exists. Unlike the work described here, AD does not
attempt verification—no attempt is made to certify a program as differentiable or Lipschitz.

5. ConCLuSion

In this paper, we have argued for the adoption of analytical properties like continuity and Lipschitz continuity
as correctness properties of programs. These properties
are relevant as they can serve as useful definitions of
robustness of programs to uncertainty. Also, they raise
some fascinating technical issues. Perhaps counterin-tuitively, some of the classic algorithms of computer
science satisfy continuity or Lipschitz continuity, and
the problem of systematic reasoning about these properties demands a nontrivial combination of analytical
and logical insights.

We believe that the work described here is a first steptoward an extension of the classical calculus to a symbolicmathematics where programs form a first-class represen-tation of functions and dynamical systems. From a practi-cal perspective, this is important as physical systems areincreasingly controlled by software, and as even appliedmathematicians increasingly reason about functions thatare not written in the mathematical notation of textbooks,but as code. Speaking more philosophically, the classicalcalculus focuses on the computational aspects of real anal-ysis, and the notation of calculus texts has evolved primar-ily to facilitate symbolic computation by hand. However, inour era, most mathematical computations are carried outby computers, and a calculus for our age should not ignorethe notation that computers can process most easily: pro-grams. This statement has serious implications—it opensthe door not only to the study of continuity or derivativesbut also to, say, Fourier transforms, differential equations,and mathematical optimization of code. Some efforts inthese directions4, 5, 9 are already under way; others will nodoubt appear in the years to come.

Acknowledgments

This research was supported by NSF CAREER Award
#1156059 (“Robustness Analysis of Uncertain Programs:
Theory, Algorithms, and Tools”).